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DETAILED ACTION 

1 . Claims 1-30 are pending. 

Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitledto a patent unless - 

(e) the invention was described in (1 ) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

3. Claims 1, 2, 5, 8, 11, 12, 15, 18, 21, 22, 25 and 28 are rejected under 35 U.S.C. 
102(e) as being anticipated by Creighton et al. (2002/0035686). 

a) As to claims 1, 11 and 21, Creighton discloses a method and system for 
issuing digital certificates as online credentials to business partners in an extranet 
comprising: generating a pre-registration record for the user (page 4, paragraph [0036]); 
sending the pre-registration record as an e-mail attachment in an e-mail message to the 
user (page 4, paragraph [0036]); generating at the client a cryptographic key pair 
comprising a user private key and a user public key (page 1, paragraph [0005]); sending 
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a PKI credential request for the PKI credentials to a certificate issuing authority, wherein 
the public key certificate request comprises the pre-regi strati on record and the user 
public key; and receiving the PKI credentials at the client (page 2, paragraph [001 1]). 

b) As to claims 2, 12 and 22, the examiner takes official notice that the use 
of retrieving user information from a directory and storing them into the pre-regi strati on 
record are known in the data communication arts. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to employ the implementation of retrieved data to may be stored or used in 
any desired manner in the system of Creighton so as to make the efficient use of data. 

c) As to claims 5, 15 and 25, Creighton discloses the method further 
comprising prompting the user for user authentication data (user identification code and 
PIN) to be included in an attribute certificate (page 4, paragraph [0036]) and storing the 
user authentication data in the PKI credential request (page 4, paragraph [0036]). 

d) As to claims 8, 18 and 28, Creighton discloses the method wherein the 
PKI credentials comprise a public key certificate for the user and an attribute certificate 
for the user (page 4, paragraph [0037]). 
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Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

5. Claims 3, 9, 13, 19, 23 and 29 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Creighton et al. (2002/0035686) in view of Padgett et al. (6,535,978). 

a) As to claims 3, 13 and 23, Creighton discloses the method further 
comprising viewing the e-mail messages within a browser, wherein the browser 
generates the crypto key pair (Fig. 2; page 1 , paragraph [0005]). Creighton does not 
explicitly disclose storing the user private key in a secure local keystore at the client. 

Padgett discloses storing the user private key in a secure local keystore at the 
client (Fig. 1). It is known in the public key encryption that the public key is used for 
encryption and public key can be freely distributed, the private key is for decryption, 
therefore the private key needs to be kept secret. 

b) As to claims 9, 19 and 29, Creighton does not disclose publishing PKI 
credentials in a directory. 

Padgett discloses PKI credentials are sent to a public directory (col. 7, lines 4-5). 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention to employ the use of storing PKI credentials to a directory in the system of 
Creighton so as to easily access to all certificates. 

6. Claims 4, 10, 14, 20, 24 and 30 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Creighton et al. (2002/0035686) in view of Brown et al. (6,671 ,805). 

a) As to claims 4, 14 and 24, Creighton does not disclose e-mail message 
is formatted according to an S/MIME standard. 

Brown discloses all transmissions over the network employ the Secure 
Multipurpose Internet Extension (S/MIME) (col. 16, lines 15-22). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to employ the use of S/MIME in the system of Creighton so as to enhanced - 
network security. 

b) As to claims 10, 20 and 30, Creighton does not disclose the PKI 
credentials are formatted according to an X.509 standard. 

Brown discloses ANSI X.509 standard is used for digital certificates (col. 14, lines 
35-36). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to employ the use of X.509 standard for digital certificates in the system of 
Creighton so as to strengthen authentication across networks. 
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7. Claims 6, 16 and 26 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Creighton et al. (2002/0035686) in view of Schneider (2002/0010745). 

Creighton does not disclose retrieving a URI from the e-mail message and 
posting the public key certificate request to the certificate issuing authority using the 
URI. 

Schneider discloses generating URI having a query portion that uses the e-mail 
addresses or contact information of the intended recipient as a search request to 
retrieve more contact information (Figs. 3a and 3b). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to employ the use of URI in the system of Creighton so as to get more contact 
information. 

8. Claims 7, 17 and 27 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Creighton et al. (2002/0035686) in view of Stewart et al. (6,571 ,221 ). 

Creighton does not disclose storing the PKI credentials in a secure local keystore 
at the client. 

Stewart discloses a network communication service with an improved subscriber 
model wherein a digital certificate is stored on the mobile user's portable computing 
device (col. 2 f lines 57-64). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to employ the use of storing PKI credentials in a secure local keystore at the 
client in the system of Creighton so as to allow client direct access to the network. 
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Conclusion 



9. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Minh Dieu Nguyen whose telephone number is 703-305- 
9727. The examiner can normally be reached on M-F 6:00-2:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell can be reached on 703-306-3036. The fax phone number 
for the organization where this application or proceeding is assigned is (703) 872-9306. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is 703-305- 
3900. 

Minh Dieu Nguyen 

Examiner 

Art Unit 2137 
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